Tus upload and apply headers in the correct order

src/plone.server/plone/server/api/content.py

@@ -124,6 +124,7 @@ async def __call__(self):
         absolute_url = queryMultiAdapter((obj, self.request), IAbsoluteURL)
 
         headers = {
+            'Access-Control-Expose-Headers': 'Location',
             'Location': absolute_url()
         }
 
@@ -283,4 +284,8 @@ async def __call__(self):
         """Apply CORS on the OPTIONS view."""
         headers = await self.preflight()
         resp = await self.render()
+        if isinstance(resp, Response):
+            headers.update(resp.headers)
+            resp.headers = headers
+            return resp
         return Response(response=resp, headers=headers, status=200)

src/plone.server/plone/server/api/files.py

@@ -8,6 +8,7 @@
 from plone.server.interfaces import IFileManager
 from plone.server.interfaces import IResource
 from plone.server.interfaces import IStaticFile
+from plone.server.api.content import DefaultOPTIONS
 from zope.component import getMultiAdapter
 
 import aiohttp
@@ -96,9 +97,9 @@ async def __call__(self):
 
 @configure.service(context=IResource, method='OPTIONS', permission='plone.AccessPreflight',
                    name='@tusupload')
-class TusOptionsFile(UploadFile):
+class TusOptionsFile(DefaultOPTIONS, UploadFile):
 
-    async def __call__(self):
+    async def render(self):
         # We need to get the upload as async IO and look for an adapter
         # for the field to save there by chunks
         adapter = getMultiAdapter(

src/plone.server/plone/server/traversal.py

@@ -210,10 +210,10 @@ def __init__(self, resource, request, view, rendered):
     async def handler(self, request):
         """Main handler function for aiohttp."""
         if request.method in WRITING_VERBS:
-            request._db_write_enabled = True
-            txn = request.conn.transaction_manager.begin(request)
             try:
                 async with locked(self.resource):
+                    request._db_write_enabled = True
+                    txn = request.conn.transaction_manager.begin(request)
                     # We try to avoid collisions on the same instance of
                     # plone.server
                     view_result = await self.view()
@@ -259,7 +259,9 @@ async def handler(self, request):
             view_result = Response({})
 
         # Apply cors if its needed
-        view_result.headers.update(apply_cors(request))
+        cors_headers = apply_cors(request)
+        cors_headers.update(view_result.headers)
+        view_result.headers = cors_headers
 
         return await self.rendered(view_result)